Yes, deposits are credited immediately (0 confirms) and the promo/bonus is also added automatically (together with the deposit).
If the user cancels the transaction using RFB and promo had credited, are they still available playing the bonus?. are you have time for monitoring all transactions?. you must to know Electrum wallet had a feature for canceling transaction (0 confirmation)
Yes, they still have both the bonus and the deposit amount (even cancelled) to play with.
Yes, we are aware of the potential of a transaction never confirming (as you describe, and also with double-spend "exploits"). And yes, we have had some unscrupulous users attempting to take advantage of this.
The way we avoid loss is to make a check at the time of withdrawal to ensure that all that user's deposits have had 4 or more confirmations before the withdrawal funds are sent back to their wallet. This we have found (and had positive feedback) is the best balance between giving access to the user's deposit immediately, and preventing dishonest individuals from stealing from the system.
Thank you for your feedback!!